Commentary

Content posted in March 2007
When The 2 Billionth Customer Record Is Stolen, Insiders Will Be The Most Guilty
Commentary  |  3/30/2007  | 
While I was researching my next story on the danger that employees, contractors, and business partners (i.e., insiders) can place on the security of corporate data, a friend of mine sent me an interesting study that noted, among several other fascinating data points, that last year personal records were compromised at a rate of 5.8 million per month. At this rate, by the end of the year more than 2 billion records
Is The Mac More Secure Than Windows? Does It Matter?
Commentary  |  3/30/2007  | 
Is the Mac more secure than Windows, in some absolute measurement of security? And does it really matter? Senior writer Sharon Gaudin talked to a few security experts and reported the consensus that, despite a recent increase in reported security flaws, the Mac is still more secure than Windows. But it's doubtful that'll change anybody's buying decisions -- Windows users know that their software has security pr
The TJX Haul: Largest Ever AND The Perfect Crime?
Commentary  |  3/30/2007  | 
The California Secretary of State web site gets to keep it's title as number one in the race to be the longest running data breach. It left three years of files exposing personal data up online, practically for the taking. But the TJX Companies take the cake when it comes to known harm. The company has the dubious distinction of having the largest ever number of stolen credit and debit cards - 45.7 million - whi
Could This Be The 'Longest-Running Internet Breach Ever'?
Commentary  |  3/23/2007  | 
That old saw, "We're from the government, and we're here to help you," could stand some updating in this digital life. How about this one: "We're from the government, and we're here to give your identity away -- no questions asked."
Spy Agency Posts Windows, OS X Security Guides
Commentary  |  3/19/2007  | 
Who should know more about security than the National Security Agency? (Hey, it's their middle name!) No one, presumably. Which is why you might want to check out a series of security configuration guides the NSA has posted for Windows XP, 2000, Mac OS X, and Sun Solaris.
Data Safety -- The Old Fashioned Way
Commentary  |  3/15/2007  | 
We can all breathe easier. WellPoint, the country's largest managed care firm, has found its missing disk -- the unencrypted one that contains the personal information (including Social Security numbers and medical records) of 75,000 people. It had been lost in transit by UPS. But they found it. Don't you feel better?
How Will You Spend Your Patch Tuesday?
Commentary  |  3/12/2007  | 
For the first time since September 2005, 30 days will come and go without what has become a monthly ritual across the IT landscape. Patch Tuesday's reliable stream of bulletins and patches has been silenced for the time being. Is this the equivalent of a snow day for IT security pros? Or are they too burnt out from dealing with Daylight Savings Time issues to even notice?
Got Time?
Commentary  |  3/2/2007  | 
That whole time-change thing that has everyone rolling their eyes -- you know, early daylight-saving time? OK, it's not Y2K. (What could be?) And as I noted in a recent column (which goes into this issue in greater detail), no one is talking disasters of biblical proportions. But there is a little more to this than the momentary irritation of missed appointments and calendars being off an hou


Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3937
PUBLISHED: 2018-08-14
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2018-3938
PUBLISHED: 2018-08-14
An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST r...
CVE-2018-12537
PUBLISHED: 2018-08-14
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
CVE-2018-12539
PUBLISHED: 2018-08-14
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows,...
CVE-2018-3615
PUBLISHED: 2018-08-14
Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.